InfraGuard
Anmelden Jetzt ausprobieren Jetzt kaufen

nginx-Schwachstellen (CVE-Liste)

nginx ist eine weit verbreitete Open-Source-Webserver- und Netzwerk-Proxy-Anwendung zur Verwaltung von eingehendem Webverkehr und zum Proxying von Protokollen.

41 CVEs1 KEV9.8 max. CVSS

Was die Historie zeigt

Die Software weist eine Historie von insgesamt 41 CVEs mit einem maximalen CVSS-Score von 9.8 auf, wobei 1 Schwachstelle in der KEV-Datenbank enthalten ist. Der neueste zugehörige CVE wurde am 2025-02-05 veröffentlicht.

So bleiben Sie sicher

Betreiber sollten bereitgestellte Versionen überwachen und auf unterstützte Release-Linien wie 1.30 oder 1.31 aktualisieren, während End-of-Life-Zweige vermieden werden sollten.

Version prüfennginx -v

Betroffene Versionslinien

Bekannte Schwachstellen

CVE Titel Betroffene Versionen CVSS Ausgenutzt EPSS Veröffentlicht
CVE-2023-44487 The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can... ≥ 1.9.5 ≤ 1.25.2 7.5 KEV 100.0% 2023-10-10
CVE-2025-23419 TLS Session Resumption Vulnerability ≥ 1.11.4 < 1.26.3 ≥ 1.27.0 < 1.27.4 5.3 2.7% 2025-02-06
CVE-2022-41742 NGINX ngx_http_mp4_module vulnerability CVE-2022-41742 ≥ 1.1.3 ≤ 1.22.0 ≥ r22 ≤ r27 = 1.23.0 7.1 1.2% 2022-10-20
CVE-2022-41741 NGINX ngx_http_mp4_module vulnerability CVE-2022-41741 ≥ 1.1.3 ≤ 1.22.0 ≥ r22 ≤ r27 = 1.23.0 7.0 0.8% 2022-10-20
CVE-2021-3618 ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing differen... < 1.21.0 7.4 2.0% 2022-03-23
CVE-2017-20005 NGINX before 1.13.6 has a buffer overflow for years that exceed four digits, as demonstrated by a file with a... < 1.13.6 * 9.8 3.3% 2021-06-07
CVE-2021-23017 A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP pack... ≥ 0.6.18 < 1.20.1 7.7 53.5% 2021-06-01
CVE-2019-20372 NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by... < 1.17.7 * 5.3 15.0% 2020-01-10
CVE-2011-4968 nginx http proxy module does not verify peer identity of https origin server which could facilitate man-in-the... = 0.7.61 = 0.7.62 = 0.7.64 4.8 4.0% 2019-11-20
CVE-2019-9511 Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation,... ≥ 1.9.5 < 1.16.1 ≥ 1.17.0 ≤ 1.17.2 7.5 59.5% 2019-08-14
CVE-2019-9513 Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service ≥ 1.9.5 < 1.16.1 ≥ 1.17.0 ≤ 1.17.2 7.5 81.6% 2019-08-14
CVE-2019-9516 Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service ≥ 1.9.5 < 1.16.1 ≥ 1.17.0 ≤ 1.17.2 7.5 57.5% 2019-08-14
CVE-2018-16843 nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for... > 1.9.5 < 1.14.1 > 1.15.0 < 1.15.6 5.3 48.0% 2018-11-07
CVE-2018-16844 nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for... ≥ 1.9.5 < 1.14.1 ≥ 1.15.0 < 1.15.6 5.3 12.7% 2018-11-07
CVE-2018-16845 nginx before versions 1.15.6, 1.14.1 has a vulnerability in the ngx_http_mp4_module, which might allow an atta... ≥ 1.0.7 ≤ 1.0.15 ≥ 1.1.3 ≤ 1.15.5 8.2 9.8% 2018-11-07
CVE-2017-7529 Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in ngin... ≥ 0.5.6 ≤ 1.12.1 ≥ 1.13.0 ≤ 1.13.2 = 0.5.6 - 1.13.2 7.5 62.6% 2017-07-13
CVE-2016-1247 The nginx package before 1.6.2-5+deb8u3 on Debian jessie, the nginx packages before 1.4.6-1ubuntu3.6 on Ubuntu... ≤ 1.10.1 ≤ 1.10.0 ≤ 1.6.2 7.8 4.9% 2016-11-30
CVE-2016-4450 os/unix/ngx_files.c in nginx before 1.10.1 and 1.11.x before 1.11.1 allows remote attackers to cause a denial... ≥ 1.3.9 < 1.10.1 = 1.11.0 7.5 16.4% 2016-06-07
CVE-2016-0742 The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of servic... ≥ 0.6.18 < 1.8.1 ≥ 1.9.0 < 1.9.10 7.5 82.4% 2016-02-16
CVE-2016-0746 Use-after-free vulnerability in the resolver in nginx 0.6.18 through 1.8.0 and 1.9.x before 1.9.10 allows remo... ≥ 0.6.18 ≤ 1.8.0 ≥ 1.9.0 < 1.9.10 9.8 8.9% 2016-02-16
CVE-2016-0747 The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 does not properly limit CNAME resolution, which all... ≥ 0.6.18 < 1.8.1 ≥ 1.9.0 < 1.9.10 5.3 8.7% 2016-02-16
CVE-2014-3556 The STARTTLS implementation in mail/ngx_mail_smtp_handler.c in the SMTP proxy in nginx 1.5.x and 1.6.x before... ≥ 1.5.6 < 1.6.1 ≥ 1.7.0 < 1.7.4 6.8 7.8% 2014-12-30
CVE-2014-3616 nginx 0.5.6 through 1.7.4, when using the same shared ssl_session_cache or ssl_session_ticket_key for multiple... ≥ 0.5.6 < 1.6.2 ≥ 1.7.0 < 1.7.5 4.3 5.7% 2014-12-08
CVE-2014-0088 The SPDY implementation in the ngx_http_spdy_module module in nginx 1.5.10 before 1.5.11, when running on a 32... = 1.5.10 7.5 8.9% 2014-04-29
CVE-2014-0133 Heap-based buffer overflow in the SPDY implementation in nginx 1.3.15 before 1.4.7 and 1.5.x before 1.5.12 all... ≥ 1.3.15 < 1.4.7 ≥ 1.5.0 ≤ 1.5.11 7.5 9.5% 2014-03-29
CVE-2013-4547 nginx 0.8.41 through 1.4.3 and 1.5.x before 1.5.7 allows remote attackers to bypass intended restrictions via... ≥ 0.8.41 < 1.4.4 ≥ 1.5.0 ≤ 1.5.6 7.5 68.5% 2013-11-24
CVE-2013-0337 The default configuration of nginx, possibly 1.3.13 and earlier, uses world-readable permissions for the (1) a... ≤ 1.3.13 = 1.0.0 = 1.0.1 7.5 2.2% 2013-10-27
CVE-2013-2028 The ngx_http_parse_chunked function in http/ngx_http_parse.c in nginx 1.3.9 through 1.4.0 allows remote attack... ≥ 1.3.9 ≤ 1.4.0 7.5 87.5% 2013-07-18
CVE-2013-2070 http/modules/ngx_http_proxy_module.c in nginx 1.1.4 through 1.2.8 and 1.3.0 through 1.4.0, when proxy_pass is... ≥ 1.1.4 ≤ 1.2.8 ≥ 1.3.9 ≤ 1.4.0 5.8 11.9% 2013-07-18
CVE-2011-4963 nginx/Windows 1.3.x before 1.3.1 and 1.2.x before 1.2.1 allows remote attackers to bypass intended access rest... ≥ 0.7.52 < 1.2.1 = 1.3.0 5.0 6.0% 2012-07-27
CVE-2012-1180 Use-after-free vulnerability in nginx before 1.0.14 and 1.1.x before 1.1.17 allows remote HTTP servers to obta... ≥ 0.1.0 < 1.0.14 ≥ 1.1.0 < 1.1.17 5.0 10.6% 2012-04-18
CVE-2012-2089 Buffer overflow in ngx_http_mp4_module.c in the ngx_http_mp4_module module in nginx 1.0.7 through 1.0.14 and 1... ≥ 1.0.7 ≤ 1.0.14 ≥ 1.1.3 ≤ 1.1.18 6.8 9.8% 2012-04-18
CVE-2011-4315 Heap-based buffer overflow in compression-pointer processing in core/ngx_resolver.c in nginx before 1.0.10 all... ≥ 0.6.18 < 1.0.10 ≥ 1.1.0 ≤ 1.1.7 6.8 6.0% 2011-12-09
CVE-2010-4180 OpenSSL before 0.9.8q, and 1.0.x before 1.0.0c, when SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG is enabled, does... < 0.9.2 4.3 9.5% 2010-12-06
CVE-2010-2263 nginx 0.8 before 0.8.40 and 0.7 before 0.7.66, when running on Windows, allows remote attackers to obtain sour... ≥ 0.7.52 < 0.7.66 ≥ 0.8.0 ≤ 0.8.39 5.0 71.9% 2010-06-15
CVE-2010-2266 nginx 0.8.36 allows remote attackers to cause a denial of service (crash) via certain encoded directory traver... ≥ 0.7.52 < 0.7.67 ≥ 0.8.0 ≤ 0.8.40 5.0 21.5% 2010-06-15
CVE-2009-4487 nginx 0.7.64 writes data to a log file without sanitizing non-printable characters, which might allow remote a... = 0.7.64 6.8 26.8% 2010-01-14
CVE-2009-3896 src/http/ngx_http_parse.c in nginx (aka Engine X) 0.1.0 through 0.4.14, 0.5.x before 0.5.38, 0.6.x before 0.6.... = 0.1.0 = 0.1.1 = 0.1.2 5.0 10.2% 2009-11-25
Offizielle Website Quellcode Eintrag auf SolutionMarket

Verfolgen Sie diese Versionen auf Ihren eigenen Servern

InfraGuard erfasst die installierten Softwareversionen auf jedem Server und markiert diejenigen mit bekannten Schwachstellen. Self-Hosted – nichts verlässt Ihr Netzwerk.

Live-Demo ausprobieren Jetzt kaufen

Wöchentlicher Digest ausgenutzter Schwachstellen

Die für Self-Hosted-Server relevanten KEV-Neuzugänge, einmal pro Woche. Keine weiteren E-Mails.

Daten: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (siehe EPSS unter https://www.first.org/epss), endoflife.date. Softwareliste: awesome-selfhosted (CC BY-SA 3.0).